aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--etc/firejail.config4
-rw-r--r--etc/inc/disable-interpreters.inc3
-rw-r--r--etc/profile-a-l/1password.profile2
-rw-r--r--etc/profile-a-l/brave.profile4
-rw-r--r--etc/profile-a-l/cachy-browser.profile4
-rw-r--r--etc/profile-a-l/discord-ptb.profile14
-rw-r--r--etc/profile-a-l/firefox.profile4
-rw-r--r--etc/profile-a-l/gnome-calendar.profile2
-rw-r--r--etc/profile-a-l/krunner.profile6
-rw-r--r--etc/profile-a-l/librewolf.profile4
-rw-r--r--etc/profile-m-z/minetest.profile5
-rw-r--r--etc/profile-m-z/mpv.profile2
-rw-r--r--etc/profile-m-z/nodejs-common.profile2
-rw-r--r--etc/profile-m-z/noprofile.profile15
-rw-r--r--etc/profile-m-z/pingus.profile3
-rw-r--r--etc/profile-m-z/rtin.profile2
-rw-r--r--etc/profile-m-z/steam.profile4
-rw-r--r--etc/profile-m-z/tin.profile4
18 files changed, 42 insertions, 42 deletions
diff --git a/etc/firejail.config b/etc/firejail.config
index e8bf45751..c3c355e3d 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -163,12 +163,12 @@
163# Xpra server command extra parameters. None by default; this is an example. 163# Xpra server command extra parameters. None by default; this is an example.
164# xpra-extra-params --dpi 96 164# xpra-extra-params --dpi 96
165 165
166# Screen size for --x11=xvfb, default 800x600x24. The third dimension is 166# Screen size for --x11=xvfb, default 800x600x24. The third dimension is
167# color depth; use 24 unless you know exactly what you're doing. 167# color depth; use 24 unless you know exactly what you're doing.
168# xvfb-screen 640x480x24 168# xvfb-screen 640x480x24
169# xvfb-screen 800x600x24 169# xvfb-screen 800x600x24
170# xvfb-screen 1024x768x24 170# xvfb-screen 1024x768x24
171# xvfb-screen 1280x1024x24 171# xvfb-screen 1280x1024x24
172 172
173# Xvfb command extra parameters. None by default; this is an example. 173# Xvfb command extra parameters. None by default; this is an example.
174# xvfb-extra-params -pixdepths 8 24 32 174# xvfb-extra-params -pixdepths 8 24 32
diff --git a/etc/inc/disable-interpreters.inc b/etc/inc/disable-interpreters.inc
index 4e3590fed..e4497f832 100644
--- a/etc/inc/disable-interpreters.inc
+++ b/etc/inc/disable-interpreters.inc
@@ -44,8 +44,7 @@ blacklist /usr/share/perl*
44# it is needed so that Firefox can run applications with Terminal=true in 44# it is needed so that Firefox can run applications with Terminal=true in
45# their .desktop file (depending on what is installed). The reason is that 45# their .desktop file (depending on what is installed). The reason is that
46# this is done via glib, which currently uses a hardcoded list of terminal 46# this is done via glib, which currently uses a hardcoded list of terminal
47# emulators: 47# emulators: https://gitlab.gnome.org/GNOME/glib/-/issues/338.
48# https://gitlab.gnome.org/GNOME/glib/-/issues/338
49# And in this list, rxvt comes before xterm. 48# And in this list, rxvt comes before xterm.
50blacklist ${PATH}/rxvt 49blacklist ${PATH}/rxvt
51 50
diff --git a/etc/profile-a-l/1password.profile b/etc/profile-a-l/1password.profile
index 690086099..63a04330b 100644
--- a/etc/profile-a-l/1password.profile
+++ b/etc/profile-a-l/1password.profile
@@ -13,7 +13,7 @@ whitelist ${HOME}/.config/1Password
13 13
14private-etc @tls-ca 14private-etc @tls-ca
15 15
16# Needed for keychain things, talking to Firefox, possibly other things? Not sure how to narrow down 16# Needed for keychain things, talking to Firefox, possibly other things?
17ignore dbus-user none 17ignore dbus-user none
18 18
19# Redirect 19# Redirect
diff --git a/etc/profile-a-l/brave.profile b/etc/profile-a-l/brave.profile
index 071a279b0..b3994c974 100644
--- a/etc/profile-a-l/brave.profile
+++ b/etc/profile-a-l/brave.profile
@@ -9,8 +9,8 @@ include globals.local
9# noexec /tmp is included in chromium-common.profile and breaks Brave 9# noexec /tmp is included in chromium-common.profile and breaks Brave
10ignore noexec /tmp 10ignore noexec /tmp
11# TOR is installed in ${HOME}. 11# TOR is installed in ${HOME}.
12# NOTE: chromium-common.profile enables apparmor. To keep that intact 12# Note: chromium-common.profile enables apparmor. To keep that intact,
13# you will need to uncomment the 'brave + tor' rule in /etc/apparmor.d/local/firejail-default. 13# uncomment the 'brave + tor' rule in /etc/apparmor.d/local/firejail-default.
14# Alternatively you can add 'ignore apparmor' to your brave.local. 14# Alternatively you can add 'ignore apparmor' to your brave.local.
15ignore noexec ${HOME} 15ignore noexec ${HOME}
16# Causes slow starts (#4604) 16# Causes slow starts (#4604)
diff --git a/etc/profile-a-l/cachy-browser.profile b/etc/profile-a-l/cachy-browser.profile
index 4b486913e..05e1a69f1 100644
--- a/etc/profile-a-l/cachy-browser.profile
+++ b/etc/profile-a-l/cachy-browser.profile
@@ -20,14 +20,14 @@ whitelist /usr/share/cachy-browser
20#whitelist ${HOME}/.mozilla 20#whitelist ${HOME}/.mozilla
21 21
22# To enable KeePassXC Plugin add one of the following lines to your cachy-browser.local. 22# To enable KeePassXC Plugin add one of the following lines to your cachy-browser.local.
23# NOTE: start KeePassXC before CachyBrowser and keep it open to allow communication between them. 23# Note: Start KeePassXC before CachyBrowser and keep it open to allow communication between them.
24#whitelist ${RUNUSER}/kpxc_server 24#whitelist ${RUNUSER}/kpxc_server
25#whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer 25#whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer
26 26
27# Add the next line to your cachy-browser.local to enable private-bin (Arch Linux). 27# Add the next line to your cachy-browser.local to enable private-bin (Arch Linux).
28#private-bin dbus-launch,dbus-send,cachy-browser,sh 28#private-bin dbus-launch,dbus-send,cachy-browser,sh
29# Add the next line to your cachy-browser.local to enable private-etc. 29# Add the next line to your cachy-browser.local to enable private-etc.
30# NOTE: private-etc must first be enabled in firefox-common.local. 30# Note: private-etc must first be enabled in firefox-common.local.
31#private-etc cachy-browser 31#private-etc cachy-browser
32 32
33dbus-user filter 33dbus-user filter
diff --git a/etc/profile-a-l/discord-ptb.profile b/etc/profile-a-l/discord-ptb.profile
index c39c0d843..265bf5615 100644
--- a/etc/profile-a-l/discord-ptb.profile
+++ b/etc/profile-a-l/discord-ptb.profile
@@ -1,17 +1,17 @@
1# Firejail profile for discord-ptb 1# Firejail profile for discord-ptb
2# This file is overwritten after every install/update 2# This file is overwritten after every install/update
3# Persistent local customizations 3# Persistent local customizations
4include discord-ptb.local 4include discord-ptb.local
5# Persistent global definitions 5# Persistent global definitions
6include globals.local 6include globals.local
7 7
8noblacklist ${HOME}/.config/discordptb 8noblacklist ${HOME}/.config/discordptb
9 9
10mkdir ${HOME}/.config/discordptb 10mkdir ${HOME}/.config/discordptb
11whitelist ${HOME}/.config/discordptb 11whitelist ${HOME}/.config/discordptb
12 12
13private-bin discord-ptb,DiscordPTB 13private-bin discord-ptb,DiscordPTB
14private-opt discord-ptb,DiscordPTB 14private-opt discord-ptb,DiscordPTB
15 15
16# Redirect 16# Redirect
17include discord-common.profile 17include discord-common.profile
diff --git a/etc/profile-a-l/firefox.profile b/etc/profile-a-l/firefox.profile
index c5fb15f74..659519ca8 100644
--- a/etc/profile-a-l/firefox.profile
+++ b/etc/profile-a-l/firefox.profile
@@ -6,7 +6,7 @@ include firefox.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9# NOTE: sandboxing web browsers is as important as it is complex. Users might be 9# Note: Sandboxing web browsers is as important as it is complex. Users might be
10# interested in creating custom profiles depending on use case (e.g. one for 10# interested in creating custom profiles depending on use case (e.g. one for
11# general browsing, another for banking, ...). Consult our FAQ/issue tracker for more 11# general browsing, another for banking, ...). Consult our FAQ/issue tracker for more
12# info. Here are a few links to get you going. 12# info. Here are a few links to get you going.
@@ -30,7 +30,7 @@ whitelist ${HOME}/.cache/mozilla/firefox
30whitelist ${HOME}/.mozilla 30whitelist ${HOME}/.mozilla
31 31
32# Add one of the following whitelist options to your firefox.local to enable KeePassXC Plugin support. 32# Add one of the following whitelist options to your firefox.local to enable KeePassXC Plugin support.
33# NOTE: start KeePassXC before Firefox and keep it open to allow communication between them. 33# Note: Start KeePassXC before Firefox and keep it open to allow communication between them.
34#whitelist ${RUNUSER}/kpxc_server 34#whitelist ${RUNUSER}/kpxc_server
35#whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer 35#whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer
36 36
diff --git a/etc/profile-a-l/gnome-calendar.profile b/etc/profile-a-l/gnome-calendar.profile
index 70a302138..ddfe57879 100644
--- a/etc/profile-a-l/gnome-calendar.profile
+++ b/etc/profile-a-l/gnome-calendar.profile
@@ -53,7 +53,7 @@ dbus-user.talk ca.desrt.dconf
53dbus-user.talk org.gnome.evolution.dataserver.* 53dbus-user.talk org.gnome.evolution.dataserver.*
54#dbus-user.talk org.gnome.OnlineAccounts 54#dbus-user.talk org.gnome.OnlineAccounts
55#dbus-user.talk org.gnome.ControlCenter 55#dbus-user.talk org.gnome.ControlCenter
56# NOTE: dbus-system none fails, filter without rules works. 56# Note: dbus-system none fails, filter without rules works.
57dbus-system filter 57dbus-system filter
58#dbus-system.talk org.freedesktop.timedate1 58#dbus-system.talk org.freedesktop.timedate1
59#dbus-system.talk org.freedesktop.login1 59#dbus-system.talk org.freedesktop.login1
diff --git a/etc/profile-a-l/krunner.profile b/etc/profile-a-l/krunner.profile
index 27feccf40..a0244ef47 100644
--- a/etc/profile-a-l/krunner.profile
+++ b/etc/profile-a-l/krunner.profile
@@ -6,9 +6,9 @@ include krunner.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9# - programs started in krunner run with this generic profile 9# Programs started in krunner run with this generic profile.
10# - when a file is opened in krunner, the file viewer runs in its own sandbox 10# When a file is opened in krunner, the file viewer runs in its own sandbox
11# with its own profile, if it is sandboxed automatically 11# with its own profile, if it is sandboxed automatically.
12 12
13# noblacklist ${HOME}/.cache/krunner 13# noblacklist ${HOME}/.cache/krunner
14# noblacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite* 14# noblacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite*
diff --git a/etc/profile-a-l/librewolf.profile b/etc/profile-a-l/librewolf.profile
index 7ddbda18c..65a4a3787 100644
--- a/etc/profile-a-l/librewolf.profile
+++ b/etc/profile-a-l/librewolf.profile
@@ -19,7 +19,7 @@ whitelist ${HOME}/.librewolf
19#whitelist ${HOME}/.mozilla 19#whitelist ${HOME}/.mozilla
20 20
21# To enable KeePassXC Plugin add one of the following lines to your librewolf.local. 21# To enable KeePassXC Plugin add one of the following lines to your librewolf.local.
22# NOTE: start KeePassXC before Librewolf and keep it open to allow communication between them. 22# Note: Start KeePassXC before Librewolf and keep it open to allow communication between them.
23#whitelist ${RUNUSER}/kpxc_server 23#whitelist ${RUNUSER}/kpxc_server
24#whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer 24#whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer
25 25
@@ -28,7 +28,7 @@ whitelist /usr/share/librewolf
28# Add the next line to your librewolf.local to enable private-bin (Arch Linux). 28# Add the next line to your librewolf.local to enable private-bin (Arch Linux).
29#private-bin dbus-launch,dbus-send,librewolf,sh 29#private-bin dbus-launch,dbus-send,librewolf,sh
30# Add the next line to your librewolf.local to enable private-etc. 30# Add the next line to your librewolf.local to enable private-etc.
31# NOTE: private-etc must first be enabled in firefox-common.local. 31# Note: private-etc must first be enabled in firefox-common.local.
32#private-etc librewolf 32#private-etc librewolf
33 33
34dbus-user filter 34dbus-user filter
diff --git a/etc/profile-m-z/minetest.profile b/etc/profile-m-z/minetest.profile
index 15474c96e..7b0135695 100644
--- a/etc/profile-m-z/minetest.profile
+++ b/etc/profile-m-z/minetest.profile
@@ -6,8 +6,9 @@ include minetest.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9# In order to save in-game screenshots to a persistent location edit ~/.minetest/minetest.conf: 9# In order to save in-game screenshots to a persistent location,
10# screenshot_path = /home/<USER>/.minetest/screenshots 10# edit ~/.minetest/minetest.conf:
11# screenshot_path = /home/<USER>/.minetest/screenshots
11 12
12noblacklist ${HOME}/.cache/minetest 13noblacklist ${HOME}/.cache/minetest
13noblacklist ${HOME}/.minetest 14noblacklist ${HOME}/.minetest
diff --git a/etc/profile-m-z/mpv.profile b/etc/profile-m-z/mpv.profile
index bd01d4082..fd35483be 100644
--- a/etc/profile-m-z/mpv.profile
+++ b/etc/profile-m-z/mpv.profile
@@ -9,7 +9,7 @@ include globals.local
9 9
10# In order to save screenshots to a persistent location, 10# In order to save screenshots to a persistent location,
11# edit ~/.config/mpv/foobar.conf: 11# edit ~/.config/mpv/foobar.conf:
12# screenshot-directory=~/Pictures 12# screenshot-directory=~/Pictures
13 13
14# mpv has a powerful Lua API and some of the Lua scripts interact with 14# mpv has a powerful Lua API and some of the Lua scripts interact with
15# external resources which are blocked by firejail. In such cases you need to 15# external resources which are blocked by firejail. In such cases you need to
diff --git a/etc/profile-m-z/nodejs-common.profile b/etc/profile-m-z/nodejs-common.profile
index f3b0c8a49..4c463521c 100644
--- a/etc/profile-m-z/nodejs-common.profile
+++ b/etc/profile-m-z/nodejs-common.profile
@@ -7,7 +7,7 @@ include nodejs-common.local
7# added by caller profile 7# added by caller profile
8#include globals.local 8#include globals.local
9 9
10# NOTE: gulp, node-gyp, npm, npx, semver and yarn are all node scripts 10# Note: gulp, node-gyp, npm, npx, semver and yarn are all node scripts
11# using the `#!/usr/bin/env node` shebang. By sandboxing node the full 11# using the `#!/usr/bin/env node` shebang. By sandboxing node the full
12# node.js stack will be firejailed. The only exception is nvm, which is implemented 12# node.js stack will be firejailed. The only exception is nvm, which is implemented
13# as a sourced shell function, not an executable binary. Hence it is not 13# as a sourced shell function, not an executable binary. Hence it is not
diff --git a/etc/profile-m-z/noprofile.profile b/etc/profile-m-z/noprofile.profile
index db4113f94..7d0e01d98 100644
--- a/etc/profile-m-z/noprofile.profile
+++ b/etc/profile-m-z/noprofile.profile
@@ -1,17 +1,16 @@
1# This is the weakest possible firejail profile. 1# This is the weakest possible firejail profile.
2# If a program still fail with this profile, it is incompatible with firejail. 2# If a program still fails with this profile, it is incompatible with firejail.
3# (from https://gist.github.com/rusty-snake/bb234cb3e50e1e4e7429f29a7931cc72) 3# (from https://gist.github.com/rusty-snake/bb234cb3e50e1e4e7429f29a7931cc72)
4# 4#
5# Usage: 5# Usage:
6# 1. download 6# $ firejail --profile=noprofile.profile /path/to/program
7# 2. firejail --profile=noprofile.profile /path/to/program
8 7
9# Keep in mind that even with this profile some things are done 8# Keep in mind that even with this profile some things are done
10# which can break the program. 9# which can break the program:
11# - some env-vars are cleared 10# - some env-vars are cleared;
12# - /etc/firejail/firejail.config can contain options such as 'force-nonewprivs yes' 11# - /etc/firejail/firejail.config can contain options such as 'force-nonewprivs yes';
13# - a new private pid-namespace is created 12# - a new private pid-namespace is created;
14# - a minimal hardcoded blacklist is applied 13# - a minimal hardcoded blacklist is applied;
15# - ... 14# - ...
16 15
17noblacklist /sys/fs 16noblacklist /sys/fs
diff --git a/etc/profile-m-z/pingus.profile b/etc/profile-m-z/pingus.profile
index 3ff033e0b..e274b6443 100644
--- a/etc/profile-m-z/pingus.profile
+++ b/etc/profile-m-z/pingus.profile
@@ -23,8 +23,9 @@ include disable-xdg.inc
23 23
24mkdir ${HOME}/.pingus 24mkdir ${HOME}/.pingus
25whitelist ${HOME}/.pingus 25whitelist ${HOME}/.pingus
26# Debian keeps games data under /usr/share/games
27whitelist /usr/share/games/pingus
26whitelist /usr/share/pingus 28whitelist /usr/share/pingus
27whitelist /usr/share/games/pingus # Debian keeps games data under /usr/share/games
28include whitelist-common.inc 29include whitelist-common.inc
29include whitelist-runuser-common.inc 30include whitelist-runuser-common.inc
30include whitelist-usr-share-common.inc 31include whitelist-usr-share-common.inc
diff --git a/etc/profile-m-z/rtin.profile b/etc/profile-m-z/rtin.profile
index 87aa69bcb..b1acf8b2e 100644
--- a/etc/profile-m-z/rtin.profile
+++ b/etc/profile-m-z/rtin.profile
@@ -1,6 +1,6 @@
1# Firejail profile for rtin 1# Firejail profile for rtin
2# Description: ncurses-based Usenet newsreader 2# Description: ncurses-based Usenet newsreader
3# symlink to tin, same as `tin -r` 3# symlink to tin, same as `tin -r`
4# This file is overwritten after every install/update 4# This file is overwritten after every install/update
5# Persistent local customizations 5# Persistent local customizations
6include rtin.local 6include rtin.local
diff --git a/etc/profile-m-z/steam.profile b/etc/profile-m-z/steam.profile
index 63d629a32..99317c9dc 100644
--- a/etc/profile-m-z/steam.profile
+++ b/etc/profile-m-z/steam.profile
@@ -133,9 +133,9 @@ whitelist ${HOME}/.steampid
133include whitelist-common.inc 133include whitelist-common.inc
134include whitelist-var-common.inc 134include whitelist-var-common.inc
135 135
136# NOTE: The following were intentionally left out as they are alternative 136# Note: The following were intentionally left out as they are alternative
137# (i.e.: unnecessary and/or legacy) paths whose existence may potentially 137# (i.e.: unnecessary and/or legacy) paths whose existence may potentially
138# clobber other paths (see #4225). If you use any, either add the entry to 138# clobber other paths (see #4225). If you use any, either add the entry to
139# steam.local or move the contents to a path listed above (or open an issue if 139# steam.local or move the contents to a path listed above (or open an issue if
140# it's missing above). 140# it's missing above).
141#mkdir ${HOME}/.config/RogueLegacyStorageContainer 141#mkdir ${HOME}/.config/RogueLegacyStorageContainer
diff --git a/etc/profile-m-z/tin.profile b/etc/profile-m-z/tin.profile
index a03a6caa0..35ff14e88 100644
--- a/etc/profile-m-z/tin.profile
+++ b/etc/profile-m-z/tin.profile
@@ -24,8 +24,8 @@ include disable-xdg.inc
24mkdir ${HOME}/.tin 24mkdir ${HOME}/.tin
25mkfile ${HOME}/.newsrc 25mkfile ${HOME}/.newsrc
26# Note: files/directories directly in ${HOME} can't be whitelisted, as 26# Note: files/directories directly in ${HOME} can't be whitelisted, as
27# tin saves .newsrc by renaming a temporary file, which is not possible for 27# tin saves .newsrc by renaming a temporary file, which is not possible for
28# bind-mounted files. 28# bind-mounted files.
29#whitelist ${HOME}/.newsrc 29#whitelist ${HOME}/.newsrc
30#whitelist ${HOME}/.tin 30#whitelist ${HOME}/.tin
31#include whitelist-common.inc 31#include whitelist-common.inc